The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
References
Link | Resource |
---|---|
http://service.sap.com/sap/support/notes/1445998 | Permissions Required |
http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions | Broken Link |
http://www.securityfocus.com/bid/48925 | Third Party Advisory VDB Entry |
http://www.securityfocus.com/bid/90533 | Third Party Advisory VDB Entry |
http://www.us-cert.gov/ncas/alerts/TA16-132A | Third Party Advisory US Government Resource |
https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2016-05-13T10:00:00
Updated: 2016-11-25T19:57:01
Reserved: 2016-05-12T00:00:00
Link: CVE-2010-5326
JSON object: View
NVD Information
Status : Analyzed
Published: 2016-05-13T10:59:00.173
Modified: 2021-04-20T18:41:50.707
Link: CVE-2010-5326
JSON object: View
Redhat Information
No data.
CWE